Extracted

• • Target

    450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin

  • Size

    388KB

  • MD5

    857ccd0b42e24d10df82a3594bf0b514

  • SHA1

    8cce4d26a66b47029ead46e5730227c193ca8e1b

  • SHA256

    450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0

  • SHA512

    9c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2

  Score

  10^/10

  diamondfoxbotnetdiscoveryspywarestealersmokeloaderbackdoortrojan

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • DiamondFox payload

    Detects DiamondFox payload in file/memory.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2